Auditing is turned on and not catching much accordingly. Only idea I have atm is netlogon debugging. Either that or they are going to have to upgrade to a supported OS.
Z Edward E. Ziots CISSP, Network +, Security + Network Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 From: VIPCS [mailto:vi...@stny.rr.com] Sent: Monday, November 29, 2010 11:07 PM To: NT System Admin Issues Subject: RE: Issue with Service and Login Account on NT 4.0 SP6a machine, ideas? Do you have auditing turned on to see what errors may be occurring on either the local machine or the domain controller when the service tries to start? True enough about GPOs, but NT 4.0 did have its own system policies. Sincerely, Jeffrey and Mary Jane Harris VIPCS ________________________________ From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Monday, November 29, 2010 7:52 AM To: NT System Admin Issues Subject: RE: Issue with Service and Login Account on NT 4.0 SP6a machine, ideas? NT 4.0 will not obey GPO's to my knowledge, since it has no knowledge of them. Account in question is a Domain Account. I am not assuming that the account was deleted and re-created accordingly. There is only two possibilities I can see at the moment ( either BAD password) or something else with authentication I am missing. ( I will check the usr-rights, for logon locally, and logon as service). Z Edward E. Ziots CISSP, Network +, Security + Network Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 From: VIPCS [mailto:vi...@stny.rr.com] Sent: Sunday, November 28, 2010 7:04 PM To: NT System Admin Issues Subject: RE: Issue with Service and Login Account on NT 4.0 SP6a machine, ideas? Did you check to see if the account password has expired, or the account is locked out? Does the account have the "login as a service" user right? Are there group policies that may be affecting the ability of the account to be granted the correct user rights? Is the account in question a domain user account, or a computer account? Note also that just because an account exists does not mean the account is what the service is looking for. If you had a domain "cvsmdm" account and it was deleted, and then recreated, it has a new SID, so that its previous permissions (such as login as a service) are gone. Finally, to follow up on what Michael Smith asked, what are the circumstances under which the problem arose? In particular, how long after raising the FFL/DFL? Sincerely, Jeffrey and Mary Jane Harris VIPCS ________________________________ From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Sunday, November 28, 2010 5:07 PM To: NT System Admin Issues Subject: Issue with Service and Login Account on NT 4.0 SP6a machine, ideas? All, Having a problem on one of my servers, that I am trying to disprove that it's a domain based problem. It's a Windows 2008 R2 FFL/DFL domain. The server in question is Windows NT 4.0 SP6a. It has a service that runs under the context of domain account. Which out of the blue has popped the following error: (Note this is a vendor supplied system) Cannot set the startup parameters for the CVSMDM_000 service. Error 1057 occurred. The account name is invalid or does not exist." The account its trying to use exists. I did a nltest /Server:SERVERNAME /SC_Query:DOMAINNAME ( which returns success, so I know the secure channel is fine). Any other ideas, only other idea I could think of was to reset the password for that account and retry or make up a new account and try that one. Maybe even a possibility of putting entries in the LMHOSTS to point directly to a Domain Controller accordingly, for this server, but again don't think that is the problem if I can verify the secure channel is good with the NLTEST command then we can eliminate that. But not sure whatelse to take a look at to see what might be the issue. Any ideas, feel free to chime in. Z Edward E. Ziots CISSP, Network +, Security + Network Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
